Privacy Policy

This Privacy Policy explains how Progma ("Progma", "we", "us", or "our") handles personal data in connection with our programming-education platform and related services (the "Service"). We are committed to handling personal data in accordance with the Philippine Data Privacy Act of 2012 (Republic Act No. 10173) and its implementing rules and regulations, and—where applicable—other data-protection laws.

1. Our role: controller and processor

Progma operates in two capacities:

As a personal information controller for data we determine the purposes of—such as account and billing administration, prospect/lead inquiries, and support.
As a personal information processor for personal data that an institution provides or directs us to process on its behalf (for example, student and teacher records and code submissions). In that case, the institution is the controller and its instructions govern. See the Data Processing Agreement.

2. Personal data we collect

Depending on your role and how the Service is used, we may collect:

Account data: name, email address, email-verification status, role, institution membership, profile image/avatar, time zone, and last-login time.
Authentication and session data: credentials (stored in hashed form), single sign-on identifiers and tokens (for example, Google OAuth — see Section 3), session identifiers, IP address, and device/browser (user-agent) information.
Two-factor authentication data: whether two-factor authentication is enabled on your account and, if you enable it, the shared secret used by your authenticator app and your one-time backup codes. Both are stored encrypted (not hashed, because the Service must be able to read them to verify a code). We also record the number of consecutive failed verification attempts and any temporary lockout time, so that repeated guessing of your code can be blocked.
Security and audit records: an append-only log of security-relevant account events — account creation, profile and status changes, role grants and revocations, email changes, two-factor authentication being enabled, disabled, or reset, backup codes being regenerated, and password changes — together with who performed the action and when. This log records the fact that a password was changed; it never stores the password itself or any hash of it.
Institution and course data: institution membership, course enrollments, academic terms, and class records.
Learning data: activities, submissions (including submitted source code and attempt data), automated grading results, and feedback.
Billing and contact data: billing-contact details, quotation requests and estimated seat counts, subscriptions, invoices, and payment records.
Prospect/lead data: information submitted through our public "Get Started" inquiry form, such as organization name, contact name, email, phone, estimated seat counts, and message content.
AI-interaction data: prompts and content you submit to AI-assisted features, including documents you upload to generate questions (such as PDFs or slide decks of course materials) and text extracted from them, images and documents you attach to messages in the AI assistant (such as screenshots, PDFs, or slide decks) and text extracted from those documents, the file name of each attached document, and your saved AI preference rules.
Usage records: counts and categories that show how the Service is used: when you sign in and with which method; how many times code is run, checked or graded, in which part of the Service, and in which programming language; how many requests AI features make on your behalf, for which feature, and how much AI processing (measured in tokens) each one uses; when an activity is published or a submission is made, with the number of items it contains; and which areas of the platform you open, such as courses, grading or the sandbox, but not which page within them. Each record notes the time, your role, and your institution at that moment. Usage records never contain your code, program input or output, answers, prompts, AI chat messages, file names, IP address, or device/browser information. They are stored in our own database, and no analytics provider receives them.
Support data: information you provide when you contact us.

3. Google user data

If you choose to sign in with Google, we receive a limited amount of data from your Google Account through Google OAuth. This section describes exactly what we receive and how we handle it.

What we access. We request only Google's basic sign-in scopes: openid, email, and profile. Through these, Google shares your Google account identifier, your email address and whether Google has verified it, your name, and your profile picture. We do not request access to Gmail, Google Drive, Google Calendar, Google Contacts, Google Classroom, or any other Google service, and we cannot read or change anything in your Google Account.

How we use it. We use Google user data only to:

verify your identity and sign you in to your existing Progma account. Google sign-in does not create accounts: accounts are provisioned by your institution, and a Google account can only be linked to a Progma account with the same email address; and
show your Google profile picture as your avatar, unless you have uploaded your own.

We do not sell Google user data, use it for advertising, or use it to develop, improve, or train artificial-intelligence or machine-learning models.

How we store and protect it. Your Google account identifier and the tokens Google issues when you sign in are stored in our database, linked to your Progma account. This data is protected by the measures described in Section 11, including encryption in transit and access controls.

How we share it. We do not share Google user data with third parties, except with the hosting and database sub-processors that operate the Service on our behalf (see our Sub-processors list), or where required by law.

Retention and deletion. We keep Google sign-in data for as long as your Google account is linked to your Progma account. You can revoke Progma's access at any time from your Google Account permissions page; after that, you can no longer sign in with Google. To have the Google account link and its stored data deleted from Progma, contact us at support@progma.app.

Limited Use. Progma's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

4. Children's and student data

The Service is used by educational institutions and may be used by students who are minors. Where students are minors, institutions are responsible for obtaining any consents required under applicable law (including from parents or legal guardians where required) and for establishing the lawful basis for processing. We process student data on behalf of the institution and in accordance with the Data Processing Agreement.

5. How we use personal data

We use personal data to:

provide, operate, secure, and support the Service;
authenticate users and maintain account and session security;
execute and grade code submissions and deliver feedback;
operate AI-assisted features you choose to use;
administer quotations, subscriptions, invoices, and payments;
respond to inquiries submitted through our public forms and to support requests;
communicate service, security, and billing notices;
understand which features are used and what the Service costs to operate, using the usage records described in Section 2. Our reports on them show totals by period, role, and institution, never the activity of an individual user; and
comply with legal obligations and enforce our Terms.

When a security-relevant change is made to your account — two-factor authentication being enabled, disabled, or reset, backup codes being regenerated, or your password being changed — we send a notice to the account's own email address so that a change you did not make does not go unnoticed. These notices are transactional rather than marketing, are sent on the basis of our legitimate interest in securing accounts, and deliberately contain no links: a message warning you about account compromise should never be indistinguishable from a phishing attempt.

6. Legal bases

Where the Data Privacy Act or other law requires a legal basis, we rely on one or more of: the performance of a contract; compliance with a legal obligation; our legitimate interests (such as securing the Service, and understanding feature use and service cost through usage records); and consent where required. For data we process on behalf of an institution, the institution is responsible for the legal basis.

We do not sell personal data. We share personal data with:

Sub-processors and service providers that help us operate the Service (for example, hosting, database, code execution, AI, and email providers). See our Sub-processors list.
The relevant institution, for data concerning its members.
Authorities and others where required by law, to protect rights and safety, or in connection with a corporate transaction, subject to appropriate safeguards.

8. International transfers

Some sub-processors may process data outside the Philippines. Where personal data is transferred across borders, we take steps intended to ensure an adequate level of protection consistent with applicable law.

9. Retention

We retain personal data for as long as needed to provide the Service, comply with legal, tax, and accounting obligations (including invoicing records), resolve disputes, and enforce our agreements. For data processed on behalf of an institution, retention and deletion follow the institution's instructions and the Data Processing Agreement. Some records are soft-deleted (excluded from normal use) before permanent deletion. Documents uploaded only to generate questions, and the text extracted from them, are deleted automatically 7 days after upload. Short excerpts quoted as a question's source stay with that question, and with any copy or export of it, until each is deleted. Images and documents attached to AI assistant messages, and the text extracted from those documents, are kept for as long as the conversation they belong to and are permanently deleted with it. An attachment that is removed before it is sent, or never sent, is deleted automatically within two days. Usage records are deleted automatically 24 months after they are created, and a user's usage records are deleted with their account if the account is permanently deleted.

AI assistant attachments. When you attach an image to an AI assistant message, we resize it and remove its embedded metadata, including any location (GPS) data, when it is uploaded, before it is stored or sent to our AI provider. When you attach a PDF or slide deck, only the text extracted from it is sent to our AI provider, never the file itself. A document's file name is stored so that you can recognize it in your conversation; it is shown only to you and is never sent to our AI provider. We do not store the file names of attached images.

10. Your rights

Subject to applicable law, data subjects may have rights to be informed, to access, to object, to rectify, to erase or block, to data portability, to lodge a complaint, and to damages. To exercise rights, contact our Data Protection Officer at dpo@progma.app. If your data is processed by Progma on behalf of an institution, we may direct your request to that institution.

Under the Data Privacy Act, you also have the right to file a complaint with the National Privacy Commission (NPC) of the Philippines.

11. Security

We maintain technical and organizational measures designed to protect personal data, including access controls, tenant isolation between institutions, encryption in transit, and audit logging of sensitive actions. Two-factor authentication is available for accounts that sign in with a password, and is required for Progma platform administrators. No method of transmission or storage is completely secure. To report a security concern, see our Security & Responsible Disclosure page or email security@progma.app.

12. Cookies

We use cookies and similar technologies, primarily for authentication and session management. See our Cookie Policy.

13. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be indicated by updating the "Last updated" date and, where appropriate, by additional notice.

14. Contact us

For privacy questions or to exercise your rights, contact our Data Protection Officer:

Email: dpo@progma.app
Mail: Data Protection Officer, Progma, Banilad, Cebu City, Cebu, 6000, Philippines

For general support, contact support@progma.app.